package com.dbxml.db.common.security;
/*
* dbXML - Native XML Database
* Copyright (c) 1999-2006 The dbXML Group, L.L.C.
*
* Permission is hereby granted, free of charge, to any person obtaining
* a copy of this software and associated documentation files (the
* "Software"), to deal in the Software without restriction, including
* without limitation the rights to use, copy, modify, merge, publish,
* distribute, sublicense, and/or sell copies of the Software, and to
* permit persons to whom the Software is furnished to do so, subject to
* the following conditions:
*
* The above copyright notice and this permission notice shall be included
* in all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
* IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
* CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
* TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
* SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
*
* $Id: DefaultSecurityManager.java,v 1.4 2006/02/02 18:53:52 bradford Exp $
*/
import com.dbxml.db.core.security.*;
import com.dbxml.db.core.Collection;
import com.dbxml.db.core.DBException;
import com.dbxml.db.core.Database;
import com.dbxml.db.core.DatabaseEventListener;
import com.dbxml.db.core.FaultCodes;
import com.dbxml.db.core.security.SecurityException;
/**
* DefaultSecurityManager is the default SecurityManager implementation
* for dbXML.
*/
public final class DefaultSecurityManager extends SecurityManagerBase {
private static final String NAME = "accessmanager";
private AccessUtils utils;
public void setDatabase(Database database) {
super.setDatabase(database);
database.addDatabaseEventListener(new DefaultEventListener());
}
private AccessUtils getAccessUtils() {
if ( utils == null ) {
try {
userStack.pushCurrentUser(magicUser);
Collection sysCol = database.getSystemCollection();
AccessManager manager = (AccessManager)sysCol.getExtensionManager().get(NAME);
utils = manager.getAccessUtils();
}
catch ( DBException e ) {
System.err.println("FATAL ERROR: Can't retrieve AccessManager Extensions '"+NAME+"'");
e.printStackTrace(System.err);
System.exit(1);
}
finally {
userStack.popCurrentUser();
}
}
return utils;
}
public void authenticate(String userID, String password) throws SecurityException {
try {
userStack.clear();
User u = readUser(userID);
if ( !u.checkPassword(password) )
throw new InvalidCredentialsException("Invalid password for User '"+userID+"'");
userStack.pushCurrentUser(u);
}
catch ( DBException e ) {
throw new SecurityException(FaultCodes.SEC + FaultCodes.GEN_CRITICAL_ERROR, e);
}
}
public void access(String path, int mask) throws SecurityException {
User user = userStack.getCurrentUser();
if ( user == null )
throw new InvalidUserException("No User has been authenticated");
if ( user != magicUser ) {
Access a = readAccess(path);
String[] roleList = user.listRoles();
int combined = 0;
for ( int i = 0 ; i < roleList.length; i++ ) {
Role role = readRole(roleList[i]);
combined |= a.getPermissions(role);
}
if ( (combined & mask) != mask )
throw new InvalidAccessException("Insufficient access to '"+path+"' for User '"+user.getId()+"'");
}
}
private User readUser(String userID) throws InvalidUserException {
try {
userStack.pushCurrentUser(magicUser);
return getAccessUtils().readUser(userID);
}
finally {
userStack.popCurrentUser();
}
}
private Role readRole(String RoleID) throws InvalidRoleException {
try {
userStack.pushCurrentUser(magicUser);
return getAccessUtils().readRole(RoleID);
}
finally {
userStack.popCurrentUser();
}
}
private Access readAccess(String path) throws InvalidAccessException {
try {
userStack.pushCurrentUser(magicUser);
return getAccessUtils().readAccess(path);
}
finally {
userStack.popCurrentUser();
}
}
/**
* DefaultEventListener
*/
private class DefaultEventListener implements DatabaseEventListener {
public void createCollection(Collection collection) {
// NOOP
}
public void dropCollection(Collection collection) {
try {
userStack.pushCurrentUser(magicUser);
getAccessUtils().removeAccess(collection.getCanonicalName());
}
catch ( DBException e ) {
// NOOP
}
finally {
userStack.popCurrentUser();
}
}
}
}